Skip to content

Commit 67af91c

Browse files
dschodscho
committed
Sync with 2.23.1
* maint-2.23: (44 commits) Git 2.23.1 Git 2.22.2 Git 2.21.1 mingw: sh arguments need quoting in more circumstances mingw: fix quoting of empty arguments for `sh` mingw: use MSYS2 quoting even when spawning shell scripts mingw: detect when MSYS2's sh is to be spawned more robustly t7415: drop v2.20.x-specific work-around Git 2.20.2 t7415: adjust test for dubiously-nested submodule gitdirs for v2.20.x Git 2.19.3 Git 2.18.2 Git 2.17.3 Git 2.16.6 test-drop-caches: use `has_dos_drive_prefix()` Git 2.15.4 Git 2.14.6 mingw: handle `subst`-ed "DOS drives" mingw: refuse to access paths with trailing spaces or periods mingw: refuse to access paths with illegal characters ...
2 parents da72936 + a7312d1 commit 67af91c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+983
-87
lines changed

‎Documentation/RelNotes/2.14.6.txt

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
Git v2.14.6 Release Notes
2+
=========================
3+
4+
This release addresses the security issues CVE-2019-1348,
5+
CVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,
6+
CVE-2019-1353, CVE-2019-1354, and CVE-2019-1387.
7+
8+
Fixes since v2.14.5
9+
-------------------
10+
11+
* CVE-2019-1348:
12+
The --export-marks option of git fast-import is exposed also via
13+
the in-stream command feature export-marks=... and it allows
14+
overwriting arbitrary paths.
15+
16+
* CVE-2019-1349:
17+
When submodules are cloned recursively, under certain circumstances
18+
Git could be fooled into using the same Git directory twice. We now
19+
require the directory to be empty.
20+
21+
* CVE-2019-1350:
22+
Incorrect quoting of command-line arguments allowed remote code
23+
execution during a recursive clone in conjunction with SSH URLs.
24+
25+
* CVE-2019-1351:
26+
While the only permitted drive letters for physical drives on
27+
Windows are letters of the US-English alphabet, this restriction
28+
does not apply to virtual drives assigned via subst <letter>:
29+
<path>. Git mistook such paths for relative paths, allowing writing
30+
outside of the worktree while cloning.
31+
32+
* CVE-2019-1352:
33+
Git was unaware of NTFS Alternate Data Streams, allowing files
34+
inside the .git/ directory to be overwritten during a clone.
35+
36+
* CVE-2019-1353:
37+
When running Git in the Windows Subsystem for Linux (also known as
38+
"WSL") while accessing a working directory on a regular Windows
39+
drive, none of the NTFS protections were active.
40+
41+
* CVE-2019-1354:
42+
Filenames on Linux/Unix can contain backslashes. On Windows,
43+
backslashes are directory separators. Git did not use to refuse to
44+
write out tracked files with such filenames.
45+
46+
* CVE-2019-1387:
47+
Recursive clones are currently affected by a vulnerability that is
48+
caused by too-lax validation of submodule names, allowing very
49+
targeted attacks via remote code execution in recursive clones.
50+
51+
Credit for finding these vulnerabilities goes to Microsoft Security
52+
Response Center, in particular to Nicolas Joly. The `fast-import`
53+
fixes were provided by Jeff King, the other fixes by Johannes
54+
Schindelin with help from Garima Singh.

‎Documentation/RelNotes/2.15.4.txt

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
Git v2.15.4 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6 to address
5+
the security issues CVE-2019-1348, CVE-2019-1349, CVE-2019-1350,
6+
CVE-2019-1351, CVE-2019-1352, CVE-2019-1353, CVE-2019-1354, and
7+
CVE-2019-1387; see the release notes for that version for details.
8+
9+
In conjunction with a vulnerability that was fixed in v2.20.2,
10+
`.gitmodules` is no longer allowed to contain entries of the form
11+
`submodule.<name>.update=!command`.

‎Documentation/RelNotes/2.16.6.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.16.6 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6 and in
5+
v2.15.4 addressing the security issues CVE-2019-1348, CVE-2019-1349,
6+
CVE-2019-1350, CVE-2019-1351, CVE-2019-1352, CVE-2019-1353,
7+
CVE-2019-1354, and CVE-2019-1387; see the release notes for those
8+
versions for details.

‎Documentation/RelNotes/2.17.3.txt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Git v2.17.3 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6 and in
5+
v2.15.4 addressing the security issues CVE-2019-1348, CVE-2019-1349,
6+
CVE-2019-1350, CVE-2019-1351, CVE-2019-1352, CVE-2019-1353,
7+
CVE-2019-1354, and CVE-2019-1387; see the release notes for those
8+
versions for details.
9+
10+
In addition, `git fsck` was taught to identify `.gitmodules` entries
11+
of the form `submodule.<name>.update=!command`, which have been
12+
disallowed in v2.15.4.

‎Documentation/RelNotes/2.18.2.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.18.2 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6, v2.15.4
5+
and in v2.17.3, addressing the security issues CVE-2019-1348,
6+
CVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,
7+
CVE-2019-1353, CVE-2019-1354, and CVE-2019-1387; see the release notes
8+
for those versions for details.

‎Documentation/RelNotes/2.19.3.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.19.3 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6, v2.15.4
5+
and in v2.17.3, addressing the security issues CVE-2019-1348,
6+
CVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,
7+
CVE-2019-1353, CVE-2019-1354, and CVE-2019-1387; see the release notes
8+
for those versions for details.

‎Documentation/RelNotes/2.20.2.txt

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
Git v2.20.2 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6, v2.15.4
5+
and in v2.17.3, addressing the security issues CVE-2019-1348,
6+
CVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,
7+
CVE-2019-1353, CVE-2019-1354, and CVE-2019-1387; see the release notes
8+
for those versions for details.
9+
10+
The change to disallow `submodule.<name>.update=!command` entries in
11+
`.gitmodules` which was introduced v2.15.4 (and for which v2.17.3
12+
added explicit fsck checks) fixes the vulnerability in v2.20.x where a
13+
recursive clone followed by a submodule update could execute code
14+
contained within the repository without the user explicitly having
15+
asked for that (CVE-2019-19604).
16+
17+
Credit for finding this vulnerability goes to Joern Schneeweisz,
18+
credit for the fixes goes to Jonathan Nieder.

‎Documentation/RelNotes/2.21.1.txt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Git v2.21.1 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6, v2.15.4,
5+
v2.17.3 and in v2.20.2, addressing the security issues CVE-2019-1348,
6+
CVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352,
7+
CVE-2019-1353, CVE-2019-1354, CVE-2019-1387, and CVE-2019-19604;
8+
see the release notes for those versions for details.
9+
10+
Additionally, this version also includes a couple of fixes for the
11+
Windows-specific quoting of command-line arguments when Git executes
12+
a Unix shell on Windows.

‎Documentation/RelNotes/2.22.2.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.22.2 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6, v2.15.4,
5+
v2.17.3, v2.20.2 and in v2.21.1, addressing the security issues
6+
CVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351,
7+
CVE-2019-1352, CVE-2019-1353, CVE-2019-1354, CVE-2019-1387, and
8+
CVE-2019-19604; see the release notes for those versions for details.

‎Documentation/RelNotes/2.23.1.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Git v2.23.1 Release Notes
2+
=========================
3+
4+
This release merges up the fixes that appear in v2.14.6, v2.15.4,
5+
v2.17.3, v2.20.2 and in v2.21.1, addressing the security issues
6+
CVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351,
7+
CVE-2019-1352, CVE-2019-1353, CVE-2019-1354, CVE-2019-1387, and
8+
CVE-2019-19604; see the release notes for those versions for details.

‎Documentation/git-fast-import.txt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,21 @@ OPTIONS
5151
memory used by fast-import during this run. Showing this output
5252
is currently the default, but can be disabled with --quiet.
5353

54+
--allow-unsafe-features::
55+
Many command-line options can be provided as part of the
56+
fast-import stream itself by using the `feature` or `option`
57+
commands. However, some of these options are unsafe (e.g.,
58+
allowing fast-import to access the filesystem outside of the
59+
repository). These options are disabled by default, but can be
60+
allowed by providing this option on the command line. This
61+
currently impacts only the `export-marks`, `import-marks`, and
62+
`import-marks-if-exists` feature commands.
63+
+
64+
Only enable this option if you trust the program generating the
65+
fast-import stream! This option is enabled automatically for
66+
remote-helpers that use the `import` capability, as they are
67+
already trusted to run their own code.
68+
5469
Options for Frontends
5570
~~~~~~~~~~~~~~~~~~~~~
5671

‎Documentation/gitmodules.txt

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,8 @@ submodule.<name>.update::
4444
submodule init` to initialize the configuration variable of
4545
the same name. Allowed values here are 'checkout', 'rebase',
4646
'merge' or 'none'. See description of 'update' command in
47-
linkgit:git-submodule[1] for their meaning. Note that the
48-
'!command' form is intentionally ignored here for security
49-
reasons.
47+
linkgit:git-submodule[1] for their meaning. For security
48+
reasons, the '!command' form is not accepted here.
5049

5150
submodule.<name>.branch::
5251
A remote branch name for tracking updates in the upstream submodule.

‎builtin/clone.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -789,7 +789,7 @@ static int checkout(int submodule_progress)
789789

790790
if (!err && (option_recurse_submodules.nr > 0)) {
791791
struct argv_array args = ARGV_ARRAY_INIT;
792-
argv_array_pushl(&args, "submodule", "update", "--init", "--recursive", NULL);
792+
argv_array_pushl(&args, "submodule", "update", "--require-init", "--recursive", NULL);
793793

794794
if (option_shallow_submodules == 1)
795795
argv_array_push(&args, "--depth=1");

‎builtin/submodule--helper.c

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
#include "diffcore.h"
2020
#include "diff.h"
2121
#include "object-store.h"
22+
#include "dir.h"
2223

2324
#define OPT_QUIET (1 << 0)
2425
#define OPT_CACHED (1 << 1)
@@ -1359,7 +1360,7 @@ static int module_clone(int argc, const char **argv, const char *prefix)
13591360
char *p, *path = NULL, *sm_gitdir;
13601361
struct strbuf sb = STRBUF_INIT;
13611362
struct string_list reference = STRING_LIST_INIT_NODUP;
1362-
int dissociate = 0;
1363+
int dissociate = 0, require_init = 0;
13631364
char *sm_alternate = NULL, *error_strategy = NULL;
13641365

13651366
struct option module_clone_options[] = {
@@ -1386,6 +1387,8 @@ static int module_clone(int argc, const char **argv, const char *prefix)
13861387
OPT__QUIET(&quiet, "Suppress output for cloning a submodule"),
13871388
OPT_BOOL(0, "progress", &progress,
13881389
N_("force cloning progress")),
1390+
OPT_BOOL(0, "require-init", &require_init,
1391+
N_("disallow cloning into non-empty directory")),
13891392
OPT_END()
13901393
};
13911394

@@ -1413,6 +1416,10 @@ static int module_clone(int argc, const char **argv, const char *prefix)
14131416
} else
14141417
path = xstrdup(path);
14151418

1419+
if (validate_submodule_git_dir(sm_gitdir, name) < 0)
1420+
die(_("refusing to create/use '%s' in another submodule's "
1421+
"git dir"), sm_gitdir);
1422+
14161423
if (!file_exists(sm_gitdir)) {
14171424
if (safe_create_leading_directories_const(sm_gitdir) < 0)
14181425
die(_("could not create directory '%s'"), sm_gitdir);
@@ -1424,6 +1431,8 @@ static int module_clone(int argc, const char **argv, const char *prefix)
14241431
die(_("clone of '%s' into submodule path '%s' failed"),
14251432
url, path);
14261433
} else {
1434+
if (require_init && !access(path, X_OK) && !is_empty_dir(path))
1435+
die(_("directory not empty: '%s'"), path);
14271436
if (safe_create_leading_directories_const(path) < 0)
14281437
die(_("could not create directory '%s'"), path);
14291438
strbuf_addf(&sb, "%s/index", sm_gitdir);
@@ -1478,6 +1487,8 @@ static void determine_submodule_update_strategy(struct repository *r,
14781487
die(_("Invalid update mode '%s' configured for submodule path '%s'"),
14791488
val, path);
14801489
} else if (sub->update_strategy.type != SM_UPDATE_UNSPECIFIED) {
1490+
if (sub->update_strategy.type == SM_UPDATE_COMMAND)
1491+
BUG("how did we read update = !command from .gitmodules?");
14811492
out->type = sub->update_strategy.type;
14821493
out->command = sub->update_strategy.command;
14831494
} else
@@ -1536,6 +1547,7 @@ struct submodule_update_clone {
15361547
int recommend_shallow;
15371548
struct string_list references;
15381549
int dissociate;
1550+
unsigned require_init;
15391551
const char *depth;
15401552
const char *recursive_prefix;
15411553
const char *prefix;
@@ -1554,7 +1566,7 @@ struct submodule_update_clone {
15541566
int max_jobs;
15551567
};
15561568
#define SUBMODULE_UPDATE_CLONE_INIT {0, MODULE_LIST_INIT, 0, \
1557-
SUBMODULE_UPDATE_STRATEGY_INIT, 0, 0, -1, STRING_LIST_INIT_DUP, 0, \
1569+
SUBMODULE_UPDATE_STRATEGY_INIT, 0, 0, -1, STRING_LIST_INIT_DUP, 0, 0, \
15581570
NULL, NULL, NULL, \
15591571
NULL, 0, 0, 0, NULL, 0, 0, 1}
15601572

@@ -1681,6 +1693,8 @@ static int prepare_to_clone_next_submodule(const struct cache_entry *ce,
16811693
argv_array_pushl(&child->args, "--prefix", suc->prefix, NULL);
16821694
if (suc->recommend_shallow && sub->recommend_shallow == 1)
16831695
argv_array_push(&child->args, "--depth=1");
1696+
if (suc->require_init)
1697+
argv_array_push(&child->args, "--require-init");
16841698
argv_array_pushl(&child->args, "--path", sub->path, NULL);
16851699
argv_array_pushl(&child->args, "--name", sub->name, NULL);
16861700
argv_array_pushl(&child->args, "--url", url, NULL);
@@ -1870,6 +1884,8 @@ static int update_clone(int argc, const char **argv, const char *prefix)
18701884
OPT__QUIET(&suc.quiet, N_("don't print cloning progress")),
18711885
OPT_BOOL(0, "progress", &suc.progress,
18721886
N_("force cloning progress")),
1887+
OPT_BOOL(0, "require-init", &suc.require_init,
1888+
N_("disallow cloning into non-empty directory")),
18731889
OPT_END()
18741890
};
18751891

0 commit comments

Comments
 (0)